7.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-31891

CVE-2026-31891: Cockpit CMS has SQL Injection in MongoLite Aggregation Optimizer via toJsonExtractRaw()

Cockpit is a headless content management system. Any Cockpit CMS instance running version 2.13.4 or earlier with API access enabled is potentially affected by a a SQL Injection vulnerability in the MongoLite Aggregation Optimizer. Any deployment where the /api/content/aggregate/{model} endpoint is publicly accessible or reachable by untrusted users may be vulnerable, and attackers in possession of a valid read-only API key (the lowest privilege level) can exploit this vulnerability — no admin access is required. An attacker can inject arbitrary SQL via unsanitized field names in aggregation queries, bypass the _state=1 published-content filter to access unpublished or restricted content, and extract unauthorized data from the underlying SQLite content database. This vulnerability has been patched in version 2.13.5. The fix applies the same field-name sanitization introduced in v2.13.3 for toJsonPath() to the toJsonExtractRaw() method in lib/MongoLite/Aggregation/Optimizer.php, closing the injection vector in the Aggregation Optimizer.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-31891

CVE-2026-31891:

7.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
cockpit-hq/cockpit	composer	< 2.13.5	2.13.5

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a SQL injection in the MongoLite Aggregation Optimizer in Cockpit CMS, present in versions prior to 2.13.5. The root cause is the failure to sanitize user-provided field names used in aggregation queries. An attacker with a low-privileged API key can send a malicious request to the /api/content/aggregate/{model} endpoint with a crafted field name, leading to arbitrary SQL execution.

The patch, identified in commit b6a0b45c5e8fe16f3027b889583cc3a9127ab4b0, addresses this by introducing proper escaping for field names. The analysis of this patch shows that several functions within lib/MongoLite/Aggregation/Optimizer.php were constructing SQL queries using raw user input. The primary vulnerable function is toJsonExtractRaw, which directly incorporated a field name into a json_extract SQL function. Other functions like applyGroup, applySort, applyCount, toJsonExtractNumeric, and toSQL were also vulnerable as they used unescaped user input to build parts of the SQL query. During an exploit, these functions would likely be present in the runtime execution profile.

Vulnerable functions

MongoLite\Aggregation\Optimizer::applyGroup

lib/MongoLite/Aggregation/Optimizer.php

The function uses the `$alias` and `$outputField` variables, which can be controlled by the user, to construct a SQL query without proper sanitization. This allows for SQL injection.

MongoLite\Aggregation\Optimizer::applySort

lib/MongoLite/Aggregation/Optimizer.php

The function uses the `$field` variable, which can be controlled by the user, to construct a SQL `ORDER BY` clause without proper sanitization. This allows for SQL injection.

MongoLite\Aggregation\Optimizer::applyCount

lib/MongoLite/Aggregation/Optimizer.php

The function uses the `$countField` variable, which can be controlled by the user, to construct a SQL alias without proper sanitization. This allows for SQL injection.

MongoLite\Aggregation\Optimizer::toJsonExtractRaw

lib/MongoLite/Aggregation/Optimizer.php

The function uses the `$field` variable, which can be controlled by the user, to construct a SQL `json_extract` function call without proper sanitization. This is the core of the SQL injection vulnerability.

MongoLite\Aggregation\Optimizer::toJsonExtractNumeric

lib/MongoLite/Aggregation/Optimizer.php

The function uses the `$field` variable, which can be controlled by the user, to construct a SQL `json_extract` function call within a `CAST` without proper sanitization. This allows for SQL injection.

MongoLite\Aggregation\Optimizer::toSQL

lib/MongoLite/Aggregation/Optimizer.php

The function uses the `$field` and `$name` variables, which can be controlled by the user, to construct a SQL `json_set` and `json_object` function calls without proper sanitization. This allows for SQL injection.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.